Moonwell
Moonwell
DeFiFoundry
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Missing Access Control on `repayBadDebtWithReserves`

vineyard

Summary

repayBadDebtWithReserves can be invoked by anyone which will affect the exchange rate directly.

Vulnerability Details

repayBadDebtWithReserves allows the caller to repay the bad debt with the contract reserves(totalReserves). And the totalReserves will directly affect the exchange rate.

(mathErr, cashPlusBorrowsMinusReserves) = addThenSubUInt(totalCash, totalBorrows, totalReserves);
if (mathErr != MathError.NO_ERROR) {
return (mathErr, 0);
}

However, since there is no access control on this function, anyone can invoke this and get benefits from the exchange rate immediately.

Impact

Attackers may benefit from the exchange rate change. Also, this is an inconsistency in governance operation to change the important value in the contract.

Tools Used

Manual

Recommendations

Adding access control on repayBadDebtWithReserves.

Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Other

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.